Fuss About Self-Signed Certificate On Dell Laptops

On the Internet fuss about a self-signed certificate which all Dell laptops would be delivered. On social news site Reddit reports reader Kevin Hicks how his new XPS Dell laptop a self-signed root certificate discovered called eDellRoot. Allows users could be attacked, for example via malware that uses the certificate.

The certificate on the Dell laptops is its own private key features that can not be exported. The key however, been found to be able to be copied. Dell user Joe Nord discovered on his laptop the same root certificate using the same private key.According to Nord Hicks and this is exactly the same situation as with Lenovo and Superfish debacle. The laptops from Lenovo came with adware that could intercept the encrypted traffic using a self-signed certificate to inject in here then ads.

In the case of Dell, however, the situation looks very different. The certificate can not be used namely to issue other certificates to perform eg man-in-the-middle attacks on HTTPS sites, says another reader on Reddit. Yet there is also criticism that Dell does not use a certificate from a valid certificate authority. Dell leaves in front of Hicks that eDellRoot is a trusted certificate and not a threat. Hicks's remark that the certificate or a security risk is the Dell Webcare team announced that the company will come with an explanation of the presence of the certificate. A spokesman confirmed to Security.NL Dell later today comes with an explanation.

Google Warns SSL Kapende Adware

Adware is not only annoying because it shows everywhere ads, it also poses a serious security risk.Before warns Google. The Internet giant is facing various forms of adware that are able to hijack SSL connections, such as with Superfish Lenovo was the case.

The adware runs through hijacking SSL connections actually a man-in-the-middle attack from users, allowing access to personal information can be obtained and the computer is vulnerable. In the case of Superfish and Komodia attackers could for example host phishing sites that caused no warning and decrypt encrypted traffic.

To avoid this kind of risk Google advises users to be careful when downloading software from the Internet. When a secure site visited, for example online banking, extra attention should be given to strange changes to the website, such as additional ads, coupons or investigations. "This may be an indication that your computer with this kind of unwanted software is infected," says Google software engineer Eric Severance.

Google Says Trust Certificates In Chinese CNNIC CA

Due to a recent incident with wrongly issued SSL certificates for Google sites Google has confidence in the Chinese certificate authority (CA) CNNIC terminated, which Google products such as Chrome will no longer recognize the certificates of CNNIC. Something that will be implemented through a future update for Chrome. Since this is very big impact, particularly Chinese Chrome users will have Google has decided to permit temporarily issued SSL certificates under CNNIC even by placing them on a public whitelist.

The reason for the measure is the recent discovery of rogue SSL certificates for various Google domains that were created by the Egyptian company MCS Holding. The company had been given the opportunity of CNNIC, which is a root CA. As root CA is CNNIC trusted by all major browsers. CNNIC had spent an intermediate certificate for MCS Holding, which the company for arbitrary domains could create SSL certificates. Because the intermediate certificate of CNNIC came, they were created SSL certificates also trusted by browsers.

According MCS Holding made ​​a human error sure that the existence of the rogue Google certificate was discovered. Google, Microsoft and Mozilla therefore decided to block these certificates. In addition, the CNNIC was heavily charged that MCS Holding gave an intermedia certificate, which the Chinese company had violated all sorts of rules. After further investigation, Google has now decided to tell all the confidence in CNNIC.
Certificate Transparency

Google argues in a statement that it believes that no other unauthorized SSL certificates have been issued or that the rogue Google certificates are used outside the test environment of MCS Holding. Regarding the Chinese certificate authority that Google must "Certificate Transparency" before implementing any request about the renewed confidence of CNNIC is considered.

Certificate Transparency is a technology developed by Google and is intended to address several structural flaws in the SSL certificate system. Thereby to unjustifiably spent and rogue SSL certificates are detected earlier. Mozilla has also decided to Certificate Transparency support .
Update

CNNIC called Google's decision unacceptable and unwise. The Chinese CA Google also calls to take the interests and rights of users into consideration. CNNIC let customers know their rights and interests will not be compromised.

Egyptian Company: Google Rogue Certificates Were Mistake

The Egyptian company that had generated rogue SSL certificates for different websites from Google calls it a mistake that Google eventually discovered the certificates and hit alarm . Indeed, it was not intended that the certificates were discovered. This week, Google warned Internet users to rogue Google certificates generated by the Egyptian MCS Holding. Through the certificates could allow an attacker to Man-in-the-middle and phishing attacks on Internet users to intercept passwords and the contents of encrypted traffic.

MCS Holding is an Egyptian security company that delivers business networking. However, it had become a so-called "intermediate" certificate authority (CA), which was linked to the Chinese certificate authority CNNIC. SSL certificates from an intermediate certificate authority originate have the full authority of the CA under which they fall. In particular, Mozilla had great criticism of CNNIC that MCS Holding had given permission to the intermediate CA to generate SSL certificates.

The Egyptian company said in a statement that it had signed an agreement with CNNIC to a two-week period intermediate CA to act. This would be necessary for the testing of a new roll from cloud service. The test took place in a secure lab where the private key of the CA certifcate, to generate SSL certificates, stored in a firewall.

However, the firewall was set to automatically generate certificates for websites that were visited on the Internet. During an unguarded moment at the weekend would be one of the IT engineers decided to use the internet with Google Chrome. Chrome offers certificate pinning, which websites can indicate what their CA SSL certificate has been issued. The browser will then put these certificates on a whitelist.

Is the website for an SSL certificate that is issued by a different CA, then turn the alarm browser. After MCS Holding by CNNIC had informed the certificate was immediately removed from the firewall and warned all parties involved. According to the Egyptian company, it is a human error which inadvertently took place. "We have no evidence of abuse, and we therefore recommend that people will not change their password or other action," said a company spokesman.

Measures

Meanwhile, Google has revoked the intermediate certificate of MCS Holding and also a Microsoft update released under Windows Users. From the description of the software giant appears that certificates for domains *. google.com , *.google.com.eg , *. g.doubleclick.net , *. gstatic.com , www.google.com , www.gmail .com and *. googleapis.com were created. Firefox comes next week with an update to revoke the certificate.

On the mailing list of Mozilla developers after the incident a heated debate erupted or CNNIC is not guilty because it would have violated all sorts of rules. While some want CNNIC is removed from the root store of Firefox. Mozilla could do this then this can have very serious consequences, especially for Chinese Firefox users, thereby HTTPS sites with SSL certificates of CNNIC and suspended beneath intermediate CAs can not visit. The Chinese CA Mozilla has therefore asked not to remove it from the root store CNNIC.

BlackBerry Devices Vulnerable FREAK Leak

BlackBerry users has warned that a large number of devices vulnerable by FREAK flaw in SSL / TLS is that early March was unveiled. Through the vulnerability, an attacker who is between a target and the Internet is in some cases the encryption of the encrypted connection to downgrade to a weak encryption to crack then that and to see the encrypted traffic.

According BlackBerry are different versions of the operating system, the BlackBerry Enterprise Server (BES), BlackBerry Messenger (BBM) and other software vulnerable. The manufacturer says that the investigation into the leak is still running, but there's already decided to publish the vulnerable systems and software. An update is not yet available, but BlackBerry says that an attacker would first have to place between the user and the Internet to carry out an attack.

Default settings, common configurations, and general "best practices" would also help to prevent a successful attack.Furthermore, the problem would be solved if users send data that already are encrypted before they are sent over SSL. For example, in the case of S / MIME or PGP. When the BlackBerry FREAK leak will patch is unknown. This week came Apple and Microsoft already with updates.

Apple Fixes FREAK Vulnerability In Mac OS X And iOS

Apple has released updates for Mac OS X, Apple TV and iOS that it " FREAK leak fixes "in SSL / TLS.Through the vulnerability, an attacker who is between a target and the Internet is in some cases the encryption of the encrypted connection to downgrade to a weak encryption to crack then that and to see the encrypted traffic.

Further resolves Security Update 2015-002 for Mac OS X four other vulnerabilities. It involves leakage and malicious app could execute arbitrary code with system privileges, memory addresses in the kernel were determined and could allow an attacker on the network arbitrary code via iCloud Keychain. iOS 8.2 fixes beside FREAK leak five other vulnerabilities.

Through these vulnerabilities, an attacker could iPods and iPads remote reboots and an attacker with physical access could see the home screen, even though the device was not activated. Furthermore, the same vulnerabilities resolved in Mac OS X, allowing attackers to execute arbitrary code. The same applies to AppleTV 7.1 , where a total of three leaks were patched.Finally, there is also an update for Xcode appeared, the development software from Apple for OS X and iOS. This five leaks were patched.